[Release]Twelve Sky AutoPot/Offset Information

[Iktov]

UPDATED.

This is for Client 1.10 and works as of July 25, 2008.

Here is an Auto HP/MP Pill or Meditation program I've been working on. Place HP Pills in the 1st or 2nd Pill slots and MP Pills in the 3rd and 4th Pill slots. You can also choose to enable auto meditation instead to restore your MP. You will need to set the Key to your meditation key(F1-F8). The default setting is F5 for the MedKey and Meditation is on by default. You can also set the HP/MP percent, the percent of depletion at witch to begin healing/medding. The default percent is 50%. You can find the log and config in C:\ drive.

Also here are the offsets for anyone interested:

PlayerPointer Addr: 0x D0A7E0
GM Enable Pointer Addr: 0x5579AC // Enables use of /find "Playername" and /movezone "zonecode" commands and also draws the player level over the name of every player. The rest of the GM commands will disconnect you unless you can bypass the extra check.

OFFSETS:

MaximumHealth: PlayerPointer + 0x164
CurrentHealth : PlayerPointer + 0x168
Maximum MP : PlayerPointer + 0x16C
Current MP : PlayerPointer + 0x170

Pill Slot Addrs:

Slot1 = A93864
Slot2 = A9386C
Slot3 = A93874
Slot4 = A9387C


Here is the scan, Some AV sites might throw up some flags however, but I beleive this is only because of the Keybd_Event function used to automatically press the keys for you ingame, The whole source is posted below at any rate and you can compile it yourself if you don't trust me:
Antivir: Nothing found
ArcaVir: Nothing found
Avast: Nothing found
AVG: Nothing found
BitDefender: Nothing found
F-Prot: Nothing found
Norman: Nothing found
Rising: Nothing found
VirusBlokAda32: Nothing found
VirusBuster: Nothing found


Scanned by

[Iktov]

/bump
If a mod wants to merge this later with the original post that would be good, I just wanted to make sure anybody who might actually care sees that its added.

Not that its anything special or that many people are actually interested but, I decided to post the source of what I have done so far. Hopefully I can get some "constructive" criticism on anything I may done in vein. Also thanks to Quicktime and Zoomgod for their input in the thread I made in the C++ forum asking how I would get it to loop threw these functions to keep it updated with the game. I wasn't exactly sure how I would hook this game for this particular purpose so I just went with a thread.

Also something maybe someone could help me with is how I might get it to only add to the log once when I want to log a function within a Loop. See the source below for what I mean. Thanks.

#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <tchar.h>
#include <iostream>
#include <time.h>
#include <stdio.h>
#include <sys/types.h>
#include <sys/timeb.h>
#include <vector>
#include <fstream>
#include <istream>
#include <string.h>
#include <detours.h>
#include <Tlhelp32.h>
#include "winject.h"
using namespace std;

#define FILELOCATION "C:12Sky.log"
#define INILOC       "C:12Sky.ini"

void __cdecl add_log(const char * fmt, ...);


HANDLE TwelveSky = GetCurrentProcess(); 
HWND SkyWnd = FindWindow(0, "TwelveSky");
DWORD PID = GetPIDbyTitle("TwelveSky");  //from winject source credits mcMike
DWORD PID2 = GetPIDbyClass("TwelveSky");

DWORD dwBytesread;
DWORD dwCurHealth;
DWORD dwMaxHealth;
DWORD dwPlayerBase; 
DWORD dwPlayerGM[2] = {};
DWORD dwPlayerGMRead;
DWORD dwCurMP;
DWORD dwMaxMP;
DWORD Slot1;
DWORD Slot2;
DWORD Slot3;
DWORD Slot4;
bool UseMed = true;
BYTE MedKey = VK_F5;
float HPPercent = 0.5;
float MPPercent = 0.5;
#define VK_1 0x31
#define VK_2 0x32
#define VK_3 0x33
#define VK_4 0x34

int SendKeyStroke(BYTE TheKeyToSend) //got this from quicktimes post in the C++ forum
{
 keybd_event(TheKeyToSend,              //msdn  
          MapVirtualKey(TheKeyToSend, 0), 
    0, 
    0); 
 keybd_event(TheKeyToSend,                
          MapVirtualKey(TheKeyToSend, 0), 
    KEYEVENTF_KEYUP, //msdn
    0);  
 return 1; 
}

DWORD ReadThread(LPVOID lpArgs)
{
	add_log("Thread Started.");
	while(1)
	{
	//005579AC   GM OFFSET
    
	ReadProcessMemory(TwelveSky, (void*)(0xD0A7E0), &dwPlayerBase, sizeof(dwPlayerBase), &dwBytesread);
	ReadProcessMemory(TwelveSky, (void*)(dwPlayerBase+0x164), &dwMaxHealth, sizeof(dwMaxHealth), &dwBytesread);
	ReadProcessMemory(TwelveSky, (void*)(dwPlayerBase+0x168), &dwCurHealth, sizeof(dwCurHealth), &dwBytesread); 
	ReadProcessMemory(TwelveSky, (void*)(dwPlayerBase+0x170), &dwCurMP, sizeof(dwCurMP), &dwBytesread); 
        ReadProcessMemory(TwelveSky, (void*)(dwPlayerBase+0x16C), &dwMaxMP, sizeof(dwMaxMP), &dwBytesread); 
        ReadProcessMemory(TwelveSky, (void*)(0xA93864), &Slot1, sizeof(Slot1), &dwBytesread);
        ReadProcessMemory(TwelveSky, (void*)(0xA9386C), &Slot2, sizeof(Slot2), &dwBytesread);
	ReadProcessMemory(TwelveSky, (void*)(0xA93874), &Slot3, sizeof(Slot3), &dwBytesread);
	ReadProcessMemory(TwelveSky, (void*)(0xA9387C), &Slot4, sizeof(Slot4), &dwBytesread);
	
  DWORD HealHealth = dwMaxHealth * HPPercent;
  DWORD RestoreMP  = dwMaxMP     * MPPercent;
  if(SkyWnd == GetForegroundWindow())
   {
	 for(dwCurHealth; dwCurHealth <= HealHealth; dwCurHealth++)
	  {
	      if(Slot1 > 0)
		  {
		      SendKeyStroke(VK_1);
			  add_log("Your HP was just Restored via Slot1");
		  }
		  else if((Slot1 == 0) && (Slot2 > 0))
		  {
              SendKeyStroke(VK_2);
			  add_log("Your HP was just Restored via Slot2");
		  }
		  else {add_log("Add HP Pills to Slot1 or Slot2");}
	  }
	 for(dwCurMP; dwCurMP <= RestoreMP; dwCurMP++)
	  {
		  if(!UseMed)
		  {
		  if(Slot3 > 0)
		  {
              SendKeyStroke(VK_3);
			  add_log("Your MP was just Restored via Slot3");
		  }
		  else if((Slot3 == 0) && (Slot4 > 0))
		  {
			  SendKeyStroke(VK_4);
			  add_log("Your MP was just Restored via Slot4");
		  }
          else {add_log("Add MP Pills to Slot3 or Slot4");}
		  }
		 if(UseMed)
		 {
              SendKeyStroke(MedKey);
			  add_log("Your MP is being Restored via Meditation");
		 }
	  }
   }
	 Sleep(1000);
	}
	return 0;
}

BOOL WINAPI DllMain (HINSTANCE hModule, DWORD dwAttached, LPVOID lpvReserved)
{
    if (dwAttached == DLL_PROCESS_ATTACH)
    {
		DeleteFile(FILELOCATION);
		CreateThread( NULL, NULL,(LPTHREAD_START_ROUTINE) ReadThread , NULL, NULL, NULL);
		add_log("--------------------------");
                add_log("--------------------------");
		add_log("----New Log Started-------");
		add_log("Attached to 12Sky Client");
                add_log("--------------------------");
		add_log("--------------------------");
		add_log("Thread Created.");
		add_log("PID = %d", PID);
		add_log("PID = %d", PID2);
        
		add_log("GM MODE INITIATED");
    }

   if (dwAttached == DLL_PROCESS_DETACH)
   {
        add_log("DLL Detached from 12Sky Client");
   }
return 1; 
}

void __cdecl add_log(const char * fmt, ...)
{
#ifndef _NO_ADD
	va_list va_alist;
	char logbuf[256];
	FILE * fp;
	struct tm * current_tm;
	time_t current_time;

	time (&current_time);
	current_tm = localtime (&current_time);

	sprintf (logbuf, "[%02d:%02d:%02d] ", current_tm->tm_hour, current_tm->tm_min, current_tm->tm_sec);

	va_start (va_alist, fmt);
	_vsnprintf (logbuf+strlen(logbuf), sizeof(logbuf) - strlen(logbuf), fmt, va_alist);
	va_end (va_alist);

	if ( (fp = fopen ( FILELOCATION , "a")) != NULL )
	{
		fprintf ( fp, "%sn", logbuf );
		fclose (fp);
	}
#endif _NO_ADD
}

[Burn91]

have you got other hacks attack speed or movment increase ?

[Iktov]

Currently, as that is not my main concern, no. At the moment I am merely focusing on finding Pointers/OFFSETS to functions for practical and helpful things such as what I have released in this thread, Auto Healing and MP Recovery. I used to play a lot during Open Beta(is it still in OB?) well during the early stages of OB and for about 2 months into it. And What I remember from PvP play is this: allthough PvP in yangok valley(Spell Check?) and Raiding other factions zones was a Whole lot of fun at Level 105+, I remember it being a button smashing experience on the HP/MP Pill keys, and that being the difference between win and lose when you get stuck into one of those long drawn out battles between one or two opponents where neither side can seem to overtake the other. As far as the GM mode Pointer I found, I kind of just stumbled upon that function in olydbg, had a look at it and found a way to access the commands, but it really wasn't my intentional goal at the time, Though its use is very helpful being able to teleport to any zone instantly saves a lot of time(especially while doing quests). I don't play however to release a binary with the GM function in it though because too many people go running around in other factions zones and cause an uproar on the forums. But I will give a tip for it, Search for any one of the commands in OlyDbg using Search for all Referenced text strings. This will take to you to function containing all of the commands. Look at the function of just one of the commands. Examine from where it starts(where the ASCII string states the command name) to where it ends(where the next commands function begins). As I already posted the pertaining OFFSET you know what to look for, the key you are looking at that point is a CMP(compair) statement.

However I do plan to post a slight tutorial on Searching the value of HP, Finding the Player Pointer in OlyDbg, Locating the OFFSET to the HP from the address you found when you searched for it, and then how to use the Player Pointer + OFFSET to HP to access your HP in-game. Maybe that will help you to pursue finding anything you may want to use. As far as releasing something such as Attack speed and the like if/when I find them, I probably will not as I would not see them used in PvP on a wide scale.

and on a side note if you(like most other people that have played the game) have witnessed the many bots in-game, You will know that a lot of stuff is indeed possible on the client side of things in this game, as all of these bots use God Mode, Use Skills from one weapon while using a different weapon, among many other things I have witnessed.

[Burn91]

nice go go go make an good trainer

[siegeless]

hi there,

does this auto pot still workable?

[bluscript]

it didnt work for me

[mathias991]

good job !
keep up

[Astinek]

I scan and i found Mal/Dloadr-E.

[afkguy]

Just go buy a copy of AFKGuy Full at (still available as of the new year)

your welcome

[afkguy]

Just go buy a copy of AFKGuy Full at (still available as of the new year) @ afkguy -- dot --- com

your welcome